<!DOCTYPE html>
<html lang="en-us">
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    
<meta charset="UTF-8">
<title>Email action | Elasticsearch Guide [7.7] | Elastic</title>
<link rel="home" href="index.html" title="Elasticsearch Guide [7.7]">
<link rel="up" href="actions.html" title="Actions">
<link rel="prev" href="action-conditions.html" title="Adding conditions to actions">
<link rel="next" href="actions-webhook.html" title="Webhook action">
<meta name="DC.type" content="Learn/Docs/Elasticsearch/Reference/7.7">
<meta name="DC.subject" content="Elasticsearch">
<meta name="DC.identifier" content="7.7">
<meta name="robots" content="noindex,nofollow">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd">
    <meta name="yandex-verification" content="d8a47e95d0972434">
    <meta name="localized" content="true">
    <meta name="st:robots" content="follow,index">
    <meta property="og:image" content="https://www.elastic.co/static/images/elastic-logo-200.png">
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles.css">
  </head>

  <!--© 2015-2021 Elasticsearch B.V. Copying, publishing and/or distributing without written permission is strictly prohibited.-->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!--BEGIN QUALTRICS WEBSITE FEEDBACK SNIPPET-->
    <script type="text/javascript">
      (function(){var g=function(e,h,f,g){
      this.get=function(a){for(var a=a+"=",c=document.cookie.split(";"),b=0,e=c.length;b<e;b++){for(var d=c[b];" "==d.charAt(0);)d=d.substring(1,d.length);if(0==d.indexOf(a))return d.substring(a.length,d.length)}return null};
      this.set=function(a,c){var b="",b=new Date;b.setTime(b.getTime()+6048E5);b="; expires="+b.toGMTString();document.cookie=a+"="+c+b+"; path=/; "};
      this.check=function(){var a=this.get(f);if(a)a=a.split(":");else if(100!=e)"v"==h&&(e=Math.random()>=e/100?0:100),a=[h,e,0],this.set(f,a.join(":"));else return!0;var c=a[1];if(100==c)return!0;switch(a[0]){case "v":return!1;case "r":return c=a[2]%Math.floor(100/c),a[2]++,this.set(f,a.join(":")),!c}return!0};
      this.go=function(){if(this.check()){var a=document.createElement("script");a.type="text/javascript";a.src=g;document.body&&document.body.appendChild(a)}};
      this.start=function(){var a=this;window.addEventListener?window.addEventListener("load",function(){a.go()},!1):window.attachEvent&&window.attachEvent("onload",function(){a.go()})}};
      try{(new g(100,"r","QSI_S_ZN_emkP0oSe9Qrn7kF","https://znemkp0ose9qrn7kf-elastic.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_emkP0oSe9Qrn7kF")).start()}catch(i){}})();
    </script><div id="ZN_emkP0oSe9Qrn7kF"><!--DO NOT REMOVE-CONTENTS PLACED HERE--></div>
    <!--END WEBSITE FEEDBACK SNIPPET-->

    <div id="elastic-nav" style="display:none;"></div>
    <script src="https://www.elastic.co/elastic-nav.js"></script>

    <!-- Subnav -->
    <div>
      <div>
        <div class="tertiary-nav d-none d-md-block">
          <div class="container">
            <div class="p-t-b-15 d-flex justify-content-between nav-container">
              <div class="breadcrum-wrapper"><span><a href="/guide/" style="font-size: 14px; font-weight: 600; color: #000;">Docs</a></span></div>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div class="main-container">
      <section id="content">
        <div class="content-wrapper">

          <section id="guide" lang="en">
            <div class="container">
              <div class="row">
                <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                  <!-- start body -->
                  <div class="page_header">
<strong>IMPORTANT</strong>: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
<a href="../current/index.html">current release documentation</a>.
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="xpack-alerting.html">Alerting on cluster and index events</a></span>
»
<span class="breadcrumb-link"><a href="actions.html">Actions</a></span>
»
<span class="breadcrumb-node">Email action</span>
</div>
<div class="navheader">
<span class="prev">
<a href="action-conditions.html">« Adding conditions to actions</a>
</span>
<span class="next">
<a href="actions-webhook.html">Webhook action »</a>
</span>
</div>
<div class="section xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="actions-email"></a>Email action<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a><a class="xpack_tag" href="/subscriptions"></a>
</h2>
</div></div></div>
<p>Use the <code class="literal">email</code> action to send email notifications. To send email, you must
<a class="xref" href="actions-email.html#configuring-email" title="Configuring email accounts">configure at least one email account</a> in
<code class="literal">elasticsearch.yml</code>.</p>
<p>Email notifications can be plain text or styled using HTML. You can include
information from the watch execution payload using <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>
and attach the entire watch payload to the message.</p>
<p>See <a class="xref" href="actions-email.html#email-action-attributes" title="Email action attributes">Email action attributes</a> for the supported attributes. Any attributes that
are missing from the email action definition are looked up in the email
account configuration. The required attributes must either be set in the email
action definition or the account’s <code class="literal">email_defaults</code>.</p>
<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="configuring-email-actions"></a>Configuring email actions<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h3>
</div></div></div>
<p>You configure email actions in the <code class="literal">actions</code> array. Action-specific attributes
are specified using the <code class="literal">email</code> keyword.</p>
<p>For example, the following email action uses a template to include data from
the watch payload in the email body:</p>
<div class="pre_wrapper lang-js">
<pre class="programlisting prettyprint lang-js">"actions" : {
  "send_email" : { <a id="CO517-1"></a><i class="conum" data-value="1"></i>
    "email" : { <a id="CO517-2"></a><i class="conum" data-value="2"></i>
      "to" : "username@example.org", <a id="CO517-3"></a><i class="conum" data-value="3"></i>
      "subject" : "Watcher Notification", <a id="CO517-4"></a><i class="conum" data-value="4"></i>
      "body" : "{{ctx.payload.hits.total}} error logs found" <a id="CO517-5"></a><i class="conum" data-value="5"></i>
    }
  }
}</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO517-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>The id of the action.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO517-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>The action type is set to <code class="literal">email</code>.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO517-3"><i class="conum" data-value="3"></i></a></p>
</td>
<td align="left" valign="top">
<p>One or more addresses to send the email to. Must be specified in the
action definition or in the email account configuration.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO517-4"><i class="conum" data-value="4"></i></a></p>
</td>
<td align="left" valign="top">
<p>The subject of the email can contain static text and Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO517-5"><i class="conum" data-value="5"></i></a></p>
</td>
<td align="left" valign="top">
<p>The body of the email can contain static text and Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>. Must be specified in the action definition or in the email
account configuration.</p>
</td>
</tr>
</table>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="configuring-email-attachments"></a>Configuring email attachments<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h3>
</div></div></div>
<p>You can attach the execution context payload or data from an any HTTP service to
the email notification. There is no limit on the number of attachments you can
configure.</p>
<p>To configure attachments, specify a name for the attached file and the type of
attachment: <code class="literal">data</code>, <code class="literal">http</code> or <code class="literal">reporting</code>. The <code class="literal">data</code> attachment type attaches the execution
context payload to the email message. The <code class="literal">http</code> attachment type enables
you to issue an HTTP request and attach the response to the email message. When
configuring the <code class="literal">http</code> attachment type, you must specify the request URL. The
<code class="literal">reporting</code> attachment type is a special type to include PDF rendered dashboards
from kibana. This type is consistently polling the kibana app if the dashboard
rendering is done, preventing long running HTTP connections, that are potentially
killed by firewalls or load balancers in-between.</p>
<div class="pre_wrapper lang-js">
<pre class="programlisting prettyprint lang-js">"actions" : {
  "email_admin" : {
    "email": {
      "to": "John Doe &lt;john.doe@example.com&gt;",
      "attachments" : {
        "my_image.png" : { <a id="CO518-1"></a><i class="conum" data-value="1"></i>
          "http" : { <a id="CO518-2"></a><i class="conum" data-value="2"></i>
            "content_type" : "image/png",
            "request" : {
              "url": "http://example.org/foo/my-image.png" <a id="CO518-3"></a><i class="conum" data-value="3"></i>
            }
          }
        },
        "dashboard.pdf" : {
          "reporting" : {
            "url": "http://example.org:5601/api/reporting/generate/dashboard/Error-Monitoring"
          }
        },
        "data.yml" : {
          "data" : {
            "format" : "yaml" <a id="CO518-4"></a><i class="conum" data-value="4"></i>
          }
        }
      }
    }
  }
}</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO518-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>The ID of the attachment, which is used as the file name in the email
attachment.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO518-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>The type of the attachment and its specific configuration.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO518-3"><i class="conum" data-value="3"></i></a></p>
</td>
<td align="left" valign="top">
<p>The URL from which to retrieve the attachment.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO518-4"><i class="conum" data-value="4"></i></a></p>
</td>
<td align="left" valign="top">
<p>Data attachments default to JSON if you don’t specify the format.</p>
</td>
</tr>
</table>
</div>
<div class="table">
<p class="title"><strong>Table 88. <code class="literal">http</code> attachment type attributes</strong></p>
<div class="table-contents">
<table border="1" cellpadding="4px" summary="http attachment type attributes">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<thead>
<tr>
<th align="left" valign="top">Name</th>
<th align="left" valign="top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left" valign="top"><p><code class="literal">content_type</code></p></td>
<td align="left" valign="top"><p>Sets the content type for the email attachment. By default,
                    the content type is extracted from the response sent by the
                    HTTP service. You can explicitly specify the content type to
                    ensure that the type is set correctly in the email in case
                    the response does not specify the content type or it’s specified
                    incorrectly. Optional.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">inline</code></p></td>
<td align="left" valign="top"><p>Configures as an attachment to sent with disposition <code class="literal">inline</code>. This
                    allows the use of embedded images in HTML bodies, which are displayed
                    in certain email clients. Optional. Defaults to <code class="literal">false</code>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">request</code></p></td>
<td align="left" valign="top"><p>Contains the HTTP request attributes. At a minimum, you must
                    specify the <code class="literal">url</code> attribute to configure the host and path to
                    the service endpoint. See <a class="xref" href="actions-webhook.html#webhook-action-attributes">Webhook action attributes</a> for
                    the full list of HTTP request attributes. Required.</p></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="table">
<p class="title"><strong>Table 89. <code class="literal">data</code> attachment type attributes</strong></p>
<div class="table-contents">
<table border="1" cellpadding="4px" summary="data attachment type attributes">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<thead>
<tr>
<th align="left" valign="top">Name</th>
<th align="left" valign="top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left" valign="top"><p><code class="literal">format</code></p></td>
<td align="left" valign="top"><p>Attaches the watch data, equivalent to specifying <code class="literal">attach_data</code>
                in the watch configuration. Possible values are <code class="literal">json</code> or <code class="literal">yaml</code>.
                Defaults to <code class="literal">json</code> if not specified.</p></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="table">
<p class="title"><strong>Table 90. <code class="literal">reporting</code> attachment type attributes</strong></p>
<div class="table-contents">
<table border="1" cellpadding="4px" summary="reporting attachment type attributes">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<thead>
<tr>
<th align="left" valign="top">Name</th>
<th align="left" valign="top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left" valign="top"><p><code class="literal">url</code></p></td>
<td align="left" valign="top"><p>The URL to trigger the dashboard creation</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">inline</code></p></td>
<td align="left" valign="top"><p>Configures as an attachment to sent with disposition <code class="literal">inline</code>. This
                    allows the use of embedded images in HTML bodies, which are displayed
                    in certain email clients. Optional. Defaults to <code class="literal">false</code>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">retries</code></p></td>
<td align="left" valign="top"><p>The reporting attachment type tries to poll regularly to receive the
                    created PDF. This configures the number of retries. Defaults to <code class="literal">40</code>.
                    The setting <code class="literal">xpack.notification.reporting.retries</code> can be configured
                    globally to change the default.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">interval</code></p></td>
<td align="left" valign="top"><p>The time to wait between two polling tries. Defaults to <code class="literal">15s</code> (this
                    means, by default watcher tries to download a dashboard for 10 minutes,
                    forty times fifteen seconds). The setting <code class="literal">xpack.notification.reporting.interval</code>
                    can be configured globally to change the default.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">request.auth</code></p></td>
<td align="left" valign="top"><p>Additional auth configuration for the request</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">request.proxy</code></p></td>
<td align="left" valign="top"><p>Additional proxy configuration for the request</p></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h4 class="title">
<a id="email-action-reports"></a>Attaching reports to an email<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h4>
</div></div></div>
<p>You can use the <code class="literal">reporting</code> attachment type in an <code class="literal">email</code> action to automatically
generate a Kibana report and distribute it via email.</p>
<p>See <a href="/guide/en/kibana/7.7/automating-report-generation.html" class="ulink" target="_top">Automating report generation</a>.</p>
</div>

</div>

<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="email-action-attributes"></a>Email action attributes<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h3>
</div></div></div>
<div class="informaltable">
<table border="1" cellpadding="4px">
<colgroup>
<col class="col_1">
<col class="col_2">
<col class="col_3">
<col class="col_4">
</colgroup>
<thead>
<tr>
<th align="left" valign="top">Name</th>
<th align="center" valign="top">Required</th>
<th align="left" valign="top">Default</th>
<th align="left" valign="top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left" valign="top"><p><code class="literal">account</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>the default account</p></td>
<td align="left" valign="top"><p>The <a class="xref" href="actions-email.html#configuring-email" title="Configuring email accounts">email account</a> to use to send the email.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">from</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The email <a class="xref" href="actions-email.html#email-address">address</a> from which the email
                                                            will be sent. The <code class="literal">from</code> field can contain Mustache
                                                            <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a> as long as it resolves to a
                                                            valid email address.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">to</code></p></td>
<td align="center" valign="top"><p>yes</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The email <a class="xref" href="actions-email.html#email-address">addresses</a> of the <code class="literal">to</code> recipients.
                                                            The <code class="literal">to</code> field can contain Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>
                                                            as long as it resolves to a valid email address.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">cc</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The email <a class="xref" href="actions-email.html#email-address">addresses</a> of the <code class="literal">cc</code> recipients.
                                                            The <code class="literal">cc</code> field can contain Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>
                                                            as long as it resolves to a valid email address.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">bcc</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The email <a class="xref" href="actions-email.html#email-address">addresses</a> of the <code class="literal">bcc</code> recipients.
                                                            The <code class="literal">bcc</code> field can contain Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>
                                                            as long as it resolves to a valid email address.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">reply_to</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The email <a class="xref" href="actions-email.html#email-address">addresses</a> that will be set on the
                                                            message’s <code class="literal">Reply-To</code> header. The <code class="literal">reply_to</code> field can contain
                                                            Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a> as long as it resolves to
                                                            a valid email address.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">subject</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The subject of the email. The subject can be static text or
                                                            contain Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">body</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The body of the email. When this field holds a string, it
                                                            will default to the text body of the email. Set as an object
                                                            to specify either the text or the html body or both (using
                                                            the fields below)</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">body.text</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The plain text body of the email. The body can be static text
                                                            or contain Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">body.html</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The html body of the email. The body can be static text or
                                                            contain Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">templates</a>. This body will be
                                                            sanitized to remove dangerous content such as scripts. This
                                                            behavior can be disabled by setting
                                                            <code class="literal">xpack.notification.email.html.sanitization.enabled: false</code> in
                                                            <code class="literal">elasticsearch.yaml</code>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">priority</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The priority of this email. Valid values are: <code class="literal">lowest</code>, <code class="literal">low</code>,
                                                            <code class="literal">normal</code>, <code class="literal">high</code> and <code class="literal">highest</code>. The priority can contain a
                                                            Mustache <a class="xref" href="how-watcher-works.html#templates" title="Using templates">template</a> as long as it resolves to
                                                            one of the valid values.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">attachments</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>Attaches the watch payload (<code class="literal">data</code> attachment) or a file
                                                            retrieved from an HTTP service (<code class="literal">http</code> attachment) to the
                                                            email. For more information, see
                                                            <a class="xref" href="actions-email.html#configuring-email-attachments" title="Configuring email attachments">Configuring Email Attachments</a>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">attach_data</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>false</p></td>
<td align="left" valign="top"><p>Indicates whether the watch execution data should be attached
                                                            to the email. You can specify a Boolean value or an object.
                                                            If <code class="literal">attach_data</code> is set to  <code class="literal">true</code>, the data is attached as a
                                                            YAML file. This attribute is deprecated, use the <code class="literal">attachments</code>
                                                            attribute to add a <code class="literal">data</code> attachment to attach the watch payload.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">attach_data.format</code></p></td>
<td align="center" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>yaml</p></td>
<td align="left" valign="top"><p>When <code class="literal">attach_data</code> is specified as an object, this field
                                                            controls the format of the attached data. The supported formats
                                                            are <code class="literal">json</code> and <code class="literal">yaml</code>. This attribute is deprecated, use the
                                                            <code class="literal">attachments</code> attribute to add a <code class="literal">data</code> attachment to attach
                                                            the watch payload.</p></td>
</tr>
</tbody>
</table>
</div>
<div class="variablelist">
<a id="email-address"></a>
<dl class="variablelist">
<dt>
<span class="term">
Email Address
</span>
</dt>
<dd>
An email address can contain two possible parts—​the address itself and an
optional personal name as described in <a href="http://www.ietf.org/rfc/rfc822.txt" class="ulink" target="_top">RFC 822</a>.
The address can be represented either as a string of the form <code class="literal">user@host.domain</code>
or <code class="literal">Personal Name &lt;user@host.domain&gt;</code>. You can also specify an email address as
an object that contains <code class="literal">name</code> and <code class="literal">address</code> fields.
</dd>
</dl>
</div>
<div class="variablelist">
<a id="address-list"></a>
<dl class="variablelist">
<dt>
<span class="term">
Address List
</span>
</dt>
<dd>
A list of addresses can be specified as a an
array: <code class="literal">[ 'Personal Name &lt;user1@host.domain&gt;', 'user2@host.domain' ]</code>.
</dd>
</dl>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="configuring-email"></a>Configuring email accounts<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h3>
</div></div></div>
<p>Watcher can send email using any SMTP email service. Email
messages can contain basic HTML tags. You can control which groups of tags are
allowed by <a class="xref" href="actions-email.html#email-html-sanitization" title="Configuring HTML sanitization options">Configuring HTML Sanitization Options</a>.</p>
<p>You configure the accounts Watcher can use to send email in the
<code class="literal">xpack.notification.email</code> namespace in <code class="literal">elasticsearch.yml</code>.
The password for the specified SMTP user is stored securely in the
<a class="xref" href="secure-settings.html" title="Secure settings">Elasticsearch keystore</a>.</p>
<p>If your email account is configured to require two step verification, you need
to generate and use a unique App Password to send email from Watcher.
Authentication will fail if you use your primary password.</p>
<p><a id="email-profile"></a>Watcher provides three email profiles that control how MIME messages are
structured: <code class="literal">standard</code> (default), <code class="literal">gmail</code>, and <code class="literal">outlook</code>. These profiles
accommodate differences in how various email systems interpret the MIME
standard. If you are using Gmail or Outlook, we recommend using the
corresponding profile. Use the <code class="literal">standard</code> profile if you are using another
email system.</p>
<p>For more information about configuring Watcher to work with different email
systems, see:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
<a class="xref" href="actions-email.html#gmail" title="Sending email from Gmail">Sending email from Gmail</a>
</li>
<li class="listitem">
<a class="xref" href="actions-email.html#outlook" title="Sending email from Outlook.com">Sending email from Outlook.com</a>
</li>
<li class="listitem">
<a class="xref" href="actions-email.html#exchange" title="Sending email from Microsoft Exchange">Sending email from Microsoft Exchange</a>
</li>
<li class="listitem">
<a class="xref" href="actions-email.html#amazon-ses" title="Sending email from Amazon SES (Simple Email Service)">Sending email from Amazon SES (Simple Email Service)</a>
</li>
</ul>
</div>
<p>If you configure multiple email accounts, you must either configure a default
account or specify which account the email should be sent with in the
<a class="xref" href="actions-email.html" title="Email action"><code class="literal">email</code></a> action.</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.notification.email:
  default_account: team1
  account:
    team1:
      ...
    team2:
      ...</pre>
</div>
<h5>
<a id="gmail"></a>Sending email from Gmail<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h5>
<p>Use the following email account settings to send email from the
<a href="https://mail.google.com" class="ulink" target="_top">Gmail</a> SMTP service:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.notification.email.account:
    gmail_account:
        profile: gmail
        smtp:
            auth: true
            starttls.enable: true
            host: smtp.gmail.com
            port: 587
            user: &lt;username&gt;</pre>
</div>
<p>To store the account SMTP password, use the keystore command
(see <a href="/guide/en/elasticsearch/reference/7.7/secure-settings.html" class="ulink" target="_top">secure settings</a>)</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">bin/elasticsearch-keystore add xpack.notification.email.account.gmail_account.smtp.secure_password</pre>
</div>
<p>If you get an authentication error that indicates that you need to continue the
sign-in process from a web browser when Watcher attempts to send email, you need
to configure Gmail to <a href="https://support.google.com/accounts/answer/6010255?hl=en" class="ulink" target="_top">Allow
Less Secure Apps to access your account</a>.</p>
<p>If two-step verification is enabled for your account, you must generate and use
a unique App Password to send email from Watcher. See
<a href="https://support.google.com/accounts/answer/185833?hl=en" class="ulink" target="_top">Sign in using App Passwords</a>
for more information.</p>
<h5>
<a id="outlook"></a>Sending email from Outlook.com<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h5>
<p>Use the following email account settings to send email action from the
<a href="https://www.outlook.com/" class="ulink" target="_top">Outlook.com</a> SMTP service:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.notification.email.account:
    outlook_account:
        profile: outlook
        smtp:
            auth: true
            starttls.enable: true
            host: smtp-mail.outlook.com
            port: 587
            user: &lt;email.address&gt;</pre>
</div>
<p>To store the account SMTP password, use the keystore command
(see <a href="/guide/en/elasticsearch/reference/7.7/secure-settings.html" class="ulink" target="_top">secure settings</a>)</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">bin/elasticsearch-keystore add xpack.notification.email.account.outlook_account.smtp.secure_password</pre>
</div>
<p>When sending emails, you have to provide a from address, either a default one
in your account configuration or as part of the email action in the watch.</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>You need to use a unique App Password if two-step verification is enabled.
        See <a href="http://windows.microsoft.com/en-us/windows/app-passwords-two-step-verification" class="ulink" target="_top">App
        passwords and two-step verification</a> for more information.</p>
</div>
</div>
<h5>
<a id="amazon-ses"></a>Sending email from Amazon SES (Simple Email Service)<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h5>
<p>Use the following email account settings to send email from the
<a href="http://aws.amazon.com/ses" class="ulink" target="_top">Amazon Simple Email Service</a> (SES) SMTP service:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.notification.email.account:
    ses_account:
        smtp:
            auth: true
            starttls.enable: true
            starttls.required: true
            host: email-smtp.us-east-1.amazonaws.com <a id="CO519-1"></a><i class="conum" data-value="1"></i>
            port: 587
            user: &lt;username&gt;</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO519-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p><code class="literal">smtp.host</code> varies depending on the region</p>
</td>
</tr>
</table>
</div>
<p>To store the account SMTP password, use the keystore command
(see <a href="/guide/en/elasticsearch/reference/7.7/secure-settings.html" class="ulink" target="_top">secure settings</a>)</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">bin/elasticsearch-keystore add xpack.notification.email.account.ses_account.smtp.secure_password</pre>
</div>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>You need to use your Amazon SES SMTP credentials to send email through
        Amazon SES. For more information, see
        <a href="http://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html" class="ulink" target="_top">Obtaining
        Your Amazon SES SMTP Credentials</a>. You might also need to verify
        <a href="https://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-email-addresses.html" class="ulink" target="_top">your email address</a>
        or <a href="https://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-domains.html" class="ulink" target="_top">your whole domain</a>
        at AWS.</p>
</div>
</div>
<h5>
<a id="exchange"></a>Sending email from Microsoft Exchange<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h5>
<p>Use the following email account settings to send email action from Microsoft
Exchange:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.notification.email.account:
    exchange_account:
        profile: outlook
        email_defaults:
            from: &lt;email address of service account&gt; <a id="CO520-1"></a><i class="conum" data-value="1"></i>
        smtp:
            auth: true
            starttls.enable: true
            host: &lt;your exchange server&gt;
            port: 587
            user: &lt;email address of service account&gt; <a id="CO520-2"></a><i class="conum" data-value="2"></i></pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO520-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>Some organizations configure Exchange to validate that the <code class="literal">from</code> field is a
valid local email account.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO520-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>Many organizations support use of your email address as your username, though
it is a good idea to check with your system administrator if you receive
authentication-related failures.</p>
</td>
</tr>
</table>
</div>
<p>To store the account SMTP password, use the keystore command
(see <a href="/guide/en/elasticsearch/reference/7.7/secure-settings.html" class="ulink" target="_top">secure settings</a>)</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">bin/elasticsearch-keystore add xpack.notification.email.account.exchange_account.smtp.secure_password</pre>
</div>
<h5>
<a id="email-html-sanitization"></a>Configuring HTML sanitization options<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions/email.asciidoc">edit</a>
</h5>
<p>The <code class="literal">email</code> action supports sending messages with an HTML body. However, for
security reasons, Watcher <a href="https://en.wikipedia.org/wiki/HTML_sanitization" class="ulink" target="_top">sanitizes</a>
the HTML.</p>
<p>You can control which HTML features are allowed or disallowed by configuring the
<code class="literal">xpack.notification.email.html.sanitization.allow</code> and
<code class="literal">xpack.notification.email.html.sanitization.disallow</code> settings in
<code class="literal">elasticsearch.yml</code>. You can specify individual HTML elements and
<a href="/guide/en/elasticsearch/reference/7.7/notification-settings.html#html-feature-groups" class="ulink" target="_top">HTML feature groups</a>. By default, Watcher allows the following
features: <code class="literal">body</code>, <code class="literal">head</code>, <code class="literal">_tables</code>, <code class="literal">_links</code>, <code class="literal">_blocks</code>, <code class="literal">_formatting</code> and
<code class="literal">img:embedded</code>.</p>
<p>For example, the following settings allow the HTML to contain tables and block
elements, but disallow  <code class="literal">&lt;h4&gt;</code>, <code class="literal">&lt;h5&gt;</code> and <code class="literal">&lt;h6&gt;</code> tags.</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.notification.email.html.sanitization:
    allow: _tables, _blocks
    disallow: h4, h5, h6</pre>
</div>
<p>To disable sanitization entirely, add the following setting to
<code class="literal">elasticsearch.yml</code>:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.notification.email.html.sanitization.enabled: false</pre>
</div>
</div>

</div>
<div class="navfooter">
<span class="prev">
<a href="action-conditions.html">« Adding conditions to actions</a>
</span>
<span class="next">
<a href="actions-webhook.html">Webhook action »</a>
</span>
</div>
</div>

                  <!-- end body -->
                </div>
                <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                  <div id="rtpcontainer" style="display: block;">
                    <div class="mktg-promo">
                      <h3>Most Popular</h3>
                      <ul class="icons">
                        <li class="icon-elasticsearch-white"><a href="https://www.elastic.co/webinars/getting-started-elasticsearch?baymax=default&amp;elektra=docs&amp;storm=top-video">Get Started with Elasticsearch: Video</a></li>
                        <li class="icon-kibana-white"><a href="https://www.elastic.co/webinars/getting-started-kibana?baymax=default&amp;elektra=docs&amp;storm=top-video">Intro to Kibana: Video</a></li>
                        <li class="icon-logstash-white"><a href="https://www.elastic.co/webinars/introduction-elk-stack?baymax=default&amp;elektra=docs&amp;storm=top-video">ELK for Logs &amp; Metrics: Video</a></li>
                      </ul>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


<div id="elastic-footer"></div>
<script src="https://www.elastic.co/elastic-footer.js"></script>
<!-- Footer Section end-->

      </section>
    </div>

<script src="/guide/static/jquery.js"></script>
<script type="text/javascript" src="/guide/static/docs.js"></script>
<script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>
